if this is true, it must be against GitHub's ToS, right?

I'm sure it would be if it were explicitly instructed to leave a star.

If not explicitly prompted by the install process then it becomes another case study in AI accountability washing.